MTA-STS checker
SMTP encryption is opportunistic by default, which means an attacker who can strip the STARTTLS advertisement gets your mail in plain text. MTA-STS is how a domain says "always use TLS, and here are the servers you may talk to".
Free, no signup, no daily limit. We do not store what you check here.
Two halves, and both have to be right
MTA-STS needs a DNS record at _mta-sts.yourdomain.com announcing a policy id, and a policy file served over HTTPS at mta-sts.yourdomain.com/.well-known/mta-sts.txt. Publishing one without the other does nothing. The split exists because DNS answers are small and untrusted while the HTTPS fetch is authenticated by the certificate, so the sensitive part — which servers are allowed — travels over the channel that can prove who it came from.
Testing mode is not protection
A policy in mode: testing reports failures and delivers anyway. It is the right place to start, and the wrong place to stay: a domain that has been in testing for a year has the configuration burden of MTA-STS and none of the benefit. Read the TLS reports, confirm nothing legitimate is failing, then switch to enforce.
Questions
Do I need MTA-STS if I already have DANE?
They solve the same problem for different audiences. DANE depends on DNSSEC, which most senders do not validate; MTA-STS depends on the web PKI, which everyone already trusts. Large providers implement MTA-STS, so if you are choosing one, that is the one more of your correspondents will honour.
What breaks if I get it wrong?
In enforce mode, mail from senders that honour the policy is deferred rather than delivered when the certificate or the MX list does not match. That is a real outage, which is why testing mode exists and why the max_age should start short.
Related tools
DMARC record checker
Check a domain DMARC policy, alignment and reporting setup. Free live DNS lookup, no signup.
MX record lookup
Look up the MX records for any domain and see who handles its mail. Free, live DNS query, no signup.
Email deliverability check
One check for MX, SPF, DMARC and DKIM on your sending domain, with what to fix first. Free, no signup.
When you need more than a free tool
This page answers what can be determined offline and from public DNS. The API adds live carrier and mailbox verification, a calibrated confidence score, and the full evidence trail behind every verdict.
Credits never expire. Inconclusive verdicts are never billed. Cancel in one call. See pricing or read the docs.